Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.
Published: 2026-09-10
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via crash when receiving a malformed UPDATE with an empty AS_PATH attribute
Action: Apply Patch
AI Analysis

Impact

GoBGP is an open source Border Gateway Protocol implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path lies in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

Affected Systems

The affected product is osrg:gobgp. All releases older than version 4.7.0 are vulnerable. Versions 4.7.0 and newer contain a fix that rejects empty AS_PATH attributes before validation.

Risk and Exploitability

The CVSS score is 5.9, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of exploitation. The likely attack vector is remote via the BGP session; an adversary who can inject malformed UPDATE packets into a BGP stream with a confederation eBGP peer could crash the process and cause a denial of service.

Generated by OpenCVE AI on September 11, 2026 at 03:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GoBGP to version 4.7.0 or later.
  • If upgrading is not immediately possible, isolate the affected confederation eBGP peers or limit routing updates to trusted sources.
  • Configure monitoring to detect unexpected process crashes or panic logs and trigger alerts.

Generated by OpenCVE AI on September 11, 2026 at 03:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-frrj-87jh-2772 GoBGP confederation validation panics on empty AS_PATH attribute
History

Fri, 11 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Osrg
Osrg gobgp
Vendors & Products Osrg
Osrg gobgp

Thu, 10 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.
Title GoBGP confederation validation panics on empty AS_PATH attribute
Weaknesses CWE-129
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Osrg Gobgp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-10T21:57:15.723Z

Reserved: 2026-06-01T18:50:36.056Z

Link: CVE-2026-49838

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-10T22:16:57.660

Modified: 2026-09-10T22:16:57.660

Link: CVE-2026-49838

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T07:30:09Z

Weaknesses
  • CWE-129

    Improper Validation of Array Index